Hi Bob,
thank you for the thorough review, detailed questions and helpful comments. Please find my answers in-line and tagged GIM>>.
I've updated the working version of the draft based on your comments and suggestions. Appreciate your feedback whether all questions have been addressed.
Attached please find the diff of -16 and the working version and the copy of the working version of the draft.
Regards,
Greg
On Mon, May 21, 2018 at 5:20 PM, Bob Briscoe <ietf@xxxxxxxxxxxxxx> wrote:
Reviewer: Bob Briscoe
Review result: Not Ready
Altho this is a TSV-ART review, I did not find many transport-related issues to
focus on, except a need to justify why lack of information for adapting the
transmit interval is not an issue.
Nonetheless, I did find a few other non-trivial technical issues, including 2
security issues, enumerated below (I mis-spent some of my early research career
working on a multicast session control and security, for which we used
beaconing control channels). However, I only have passing prior knowledge of
BFD, so my critique might be off-beam.
==Main Technical Concerns===
1/ Mandatory return path?
RFC5880 is the base RFC that this draft updates. RFC5880 says that
"unidirectional links" are in scope, but only as long as there is a return path.
The introduction of this bfd-multipoint draft seems to contradict that, making
a return path optional: "
As an option, the tail may notify the head of the lack of multipoint
connectivity. Details of tail notification to the head are outside
the scope of this document.
"
It's allowable for irrelevant details to be outside the scope, but surely it
needs to be clear whether at least the existence of a return path is mandatory.
GIM>> Thank you for highlighting this issue.. I think that the second paragraph of Introduction is the appropriate place to note that this mechanism does not require existence of a return path from tails to the head. Would the following be acceptable:
NEW TEXT:
Use of BFD in
Demand mode enables a tail monitor availability of a multipoint path
even without the existence of some kind of a return path to the head.
2/ Mechanism for verifying connectivity, or not?
The introduction seems to contradict itself:
"
As multipoint transmissions are inherently unidirectional, this
mechanism purports only to verify this unidirectional connectivity.
"
"
Term "connectivity" in this document is not being used in the context
of connectivity verification in transport network but as an
alternative to "continuity", i.e. existence of a forwarding path
between the sender and the receiver.
"
How can this mechanism verify connectivity, but not be used in the context of
connectivity verification in the transport network?
GIM>> This draft defines the base specification for multipoint BFD. In order for multipoint BFD to support the transport-like connectivity verification we need to do work similar to described in RFC 6428.
3/ Use case
The introduction seems to be written rather academically. Surely, in cases
where there is never a return path, only the tails will ever be able to verify
connectivity. The head could continue transmitting BFD packets (and data
packets) for years without ever knowing whether it is connected to anything..
Knowledge of connectivity is surely of little use if it excludes the link
sender, which is the node that always controls routing.
If there are scenarios where it is useful for tails but not the head to be able
to verify connectivity, can you please give a concrete example?
GIM>> One example could be a multicast system with 1+1 protection. Without multipoint BFD tails would not be able to detect the failure of the muticast path from the head. Other examples discussed in several drafts:
- BESS WG draft MVPN fast upstream failover
- Individual draft BFD for Multipoint Networks and VRRP Use Case
- Individual draft BFD for Multipoint Networks and PIM-SM Use Case
4/ Interval adaptation
Text is needed to describe why it is not an issue for the head to be unaware
whether it needs to adapt its transmit interval. Otherwise, this seems
potentially problematic.
GIM>> Very interesting, thank you. I wouldn't say that the case when a tail cannot process incoming mpBFD control packets at the offered rate is entirely non-issue. Such scenario must be handled by the implementation and may be controlled by local policy, e.g., close the MultipointTail session. Where would you suggest to add the text?
5/ Inability to authenticate the sender with symmetric keys
In unicast scenarios, symmetric keys can be used for message authentication,
because each end knows there is only one other node with the shared key. But,
in multipoint scenarios, all the tails would share the key, so a shared key
does not authenticate who sent the message - any tail can spoof the head from
the viewpoint of the other tails.
Therefore text is needed to say that:
* multipoint message authentication is limited to cases where all tails are
trusted not to spoof the head, if shared keys are used. * otherwise asymmetric
message authentication would be needed, e.g. TESLA [RFC4082]
GIM>> Thank you for the suggested text. Would the Security Considerations section be appropriate place:
NEW TEXT:
Use of shared keys to authenticate BFD Control packet in multipoint
scenarios is limited because tail can spoof the head from the
viewpoint of the other tails. Thus, if shared keys are used, all
tails MUST be trusted not to spoof the head. Otherwise, asymmetric
message authentication would be needed, e.g., Timed Efficient Stream
Loss-Tolerant Authentication (TESLA) as described in [RFC4082].
A related nit: Section 5 says all tails are assumed to have a common
authentication key. In cases with symmetric message authentication, surely the
head also needs the same key.
GIM>> Thank you. Please check the updated text:
NEW TEXT:
If authentication is in use, the head and all tails must be
configured to have a common authentication key in order for the tails
to validate received the multipoint BFD Control packets.
6/ Source address spoofing
A 3-way handshake makes a protocol robust against simple source address
spoofing. Without a 3WHS, surely the spec. needs to highlight this
vulnerability or discuss ways to address it or why it is not an issue.
GIM>> Because mpBFD control packets cannot be demultiplexed by tail based on the value of Your Discriminator field as per RFC 5880,
the new procedure outlined in Section 4.7:
IP and MPLS multipoint tails MUST demultiplex BFD packets based on a
combination of the source address, My Discriminator and the identity
of the multipoint tree which the Multipoint BFD Control packet was
received from. Together they uniquely identify the head of the
multipoint path.
and described in details in Section 4.13.2:
If the Multipoint (M) bit is set
If the Your Discriminator field is nonzero, the packet MUST be
discarded.
Select a session as based on source address, My Discriminator
and the identity of the multipoint tree which the Multipoint
BFD Control packet was received. If a session is found, and
bfd.SessionType is not MultipointTail, the packet MUST be
discarded. If a session is not found, a new session of type
MultipointTail MAY be created, or the packet MAY be discarded.
This choice is outside the scope of this specification.
Would you suggest additional text to a use case where the new demultiplexing is not sufficent to protect from source address spoofing?
7/ Scope
On eight occasions an issue is raised, but resolution is stated as outside the
scope of this document. It is OK to limit the scope of a spec, for example to
allow for multiple solutions to each issue. But at least one solution must
already exist for each of these eight issues. So, at least one example solution
ought to be cited in each case. If any issues are open, then this should not be
on the standards track.
It would be more useful to state why each issue is out of scope. This would be
helped by stating from the start what the scope of the document is.
GIM>> I've listed all eight occasions with the explanation for each one:
- Details of tail notification to the head are outside the scope of this document. - Notifications by tails addressed in draft-ietf-bfd-multipoint-active-tail. Will add as informational reference.
- Details of how the head keeps track of tails and how tails alert their connectivity to the head are outside scope of this document. - Same as #1.
- Bootstrapping BFD session to multipoint MPLS LSP in case of penultimate hop popping is outside the scope of this document. - It may use control plane as in MVPN draft. Will add as informational reference.
- Use of other types of encapsulation of the BFD control message over multipoint LSP is outside the scope of this document. - This in reference to ACH encapsulation that is discussed in draft-mirsky-mpls-p2mp-bfd. Should it be added as informational reference? What would be the imacpt of progressing this specification?
- Change in the value of bfd.RequiredMinRxInterval is outside the scope of this document. - Same as #1.
- If a session is not found, a new session of type MultipointTail MAY be created, or the packet MAY be discarded. This choice is outside the scope of this specification. - I propose to add "based on local policy" to the last sentence.
- The exact method of selection is application-specific and is thus outside the scope of this specification. - This is copied from RFC 5880: "The exact method of selection is application specific and is thus outside the scope of this specification." as the section is to replace Section 6.8.6.
- If a matching session is not found, a new session of type PointToPoint MAY be created, or the packet MAY be discarded. This choice is outside the scope of this specification. - Same as #6.
There is also one issue that is "for further discussion". Does this mean the
document is not ready yet?
GIM>> I think that the question left for further discussion is non-technical:
The semantic difference between Down and AdminDown state is for
further discussion.
I propose to remove the sentence altogether.
8/ Incremental deployment
Section 4.4.1. "New State Variable Values" defines bfd.SessionType =
PointToPoint as well as a couple of Multipoint alternatives. Presumably this
spec does not require all existing PointToPoint systems to support this state
value. Is the implication that only Multipoint systems that happen to be in
PointToPoint mode should use this state?
GIM>> You're aboultely right, existing implementations of BFD don't need to support bfd.SessionType variable. Only implementations that support the base BFD, single-hop or multi-hop, and this specification, mpBFD, should support bfd.SessionType and set it to PointToPoint value when BFD is in single-hop or multi-hop mode. When in mpBFD mode, bfd.SessionType will be set to either MultipointHead or MultipointClient.
==Nits==
* Sometimes 'tree' is used to mean a multipoint path in general. I suspect
'path' was intended.
GIM>> I've found six occasions of "tree" and s/tree/path/
4.8. Packet consumption on tails
s/Node/Nodes/
s/packet/packets/
s/demultiplex/demultiplexed/
GIM>> Accepted all three.
4.9. Bringing Up and Shutting Down Multipoint BFD Service
"
a newly
started head (that does not have any previous state information
available) SHOULD start with...
"
....
"
... (so long as the restarted head
is using the same or a larger value of bfd.DesiredMinTxInterval than
it did previously).
"
If it has no state available, how can it know whether a value is larger than
previously?
GIM>> You are right, the BFD system at the head would not know the previous value of bfd.DesiredMinTxInterval. This text is to caution operator from decreasing
bfd.DesiredMinTxInterval upon restart of the BFD system.
4.9. Bringing Up and Shutting Down Multipoint BFD Service
There are a number of "SHOULD"s and "SHOULD NOT"s that do not state or give
examples of circumstances in which the "SHOULD" would not be appropriate. If
there are none, "MUST" would be more appropriate.
GIM>> In the first paragraph SHOULD may not be followed if the implementation can differentiate between the very first start and restarts of BFD system. If it is the first start of BFD system, the head MAY directly progress to Up state skipping Down state.
The last paragraph describes graceful shuttdown. The head MAY shut the BFD mp session abruptly by just stopping transmission of BFD Control packets.
4.10. Timer Manipulation
"
Because of the one-to-many mapping, a session of type MultipointHead
SHOULD NOT initiate a Poll Sequence in conjunction with timer value
changes. However, to indicate a change in the packets,
MultipointHead session MUST send packets with the P bit set.
MultipointTail session MUST NOT reply if the packet has M and P bits
set and bfd.RequiredMinRxInterval set to 0.
"
The initial "SHOULD NOT" needs to be written another way. Perhaps
"
...a session of type MultipointHead
does not initiate a Poll Sequence
"
The head's normative action is defined by the following "MUST", then the tail's
"MUST NOT reply" is what prevents the poll sequence happening.
GIM>> A Poll Sequence starts with the initiator setting Poll bit. Unless the peer sends BFD Control packet with Finl bit set the poll sequence would continue indefinetely. The initial SHOULD NOT, in my opinion, correctly points that the mechanism of Poll Sequence not to be used by MultipointHead when changing transmission interval. I think that MUST in the first paragraph can be downgraded to MAY because the MultipointHead doesn't need to use transition period when changing the transmission interval to lower level, i.e., decreasing frequency. May I propose the following:
OLD TEXT:
Because of the one-to-many mapping, a session of type MultipointHead
SHOULD NOT initiate a Poll Sequence in conjunction with timer value
changes. However, to indicate a change in the packets,
MultipointHead session MUST send packets with the P bit set.
NEW TEXT:
Because of the one-to-many mapping, a session of type MultipointHead
SHOULD NOT initiate a Poll Sequence in conjunction with timer value
changes. However, to indicate a change in the packets,
MultipointHead session MAY send packets with the P bit set during transition period.
4.11. Detection Times
Delete "in the calculation" (repetition).
GIM>> Done.
4.13.1. Reception of BFD Control Packets
Some actions seem to be only relevant to PointToPoint sessions, but they are
stated for all session types. Specifically: "the transmission of Echo packets,
if any, MUST cease." "the Poll Sequence MUST be terminated." "MUST cease the
periodic transmission of BFD Control packets" "MUST send periodic BFD Control
packets"
"
If bfd.SessionType is PointToPoint, update the Detection Time as
described in section 6.8.4 of [RFC5880]. If bfd.SessionType is
MultipointTail,
"
The second sentence above ought to start on a new line as an Else if.
GIM>> Hope I got it right:
If bfd.SessionType is PointToPoint, update the Detection Time as
described in section 6.8.4 of [RFC5880].
Else
If bfd.SessionType is MultipointTail, then update the Detection
Time as the product of the last received values of Desired Min
TX Interval and Detect Mult, as described in Section 5..11 of
this specification.
4.13.2. Demultiplexing BFD Control Packets
"
This section is part of the replacement for [RFC5880] section 6.8.6,
separated for clarity.
"
Do you mean "This section replaces the sentence: "If the Multipoint (M) bit is
nonzero, the packet MUST be discarded." in [RFC5880] section 6.8.6?
The statements under "If the Multipoint (M) bit is set" are not formatted like
the rest of the if-else logic, and I think an Else is missing at the start of
the statement after the nested "If".
GIM>> Agree, the paragraph is not structured properly. How about this formating:
If the Multipoint (M) bit is set
If the Your Discriminator field is nonzero, the packet MUST be
discarded.
Select a session as based on source address, My Discriminator
and the identity of the multipoint path which the Multipoint
BFD Control packet was received.
If a session is found, and bfd.SessionType is not
MultipointTail, the packet MUST be discarded..
Else
If a session is not found, a new session of type
MultipointTail MAY be created, or the packet MAY be
discarded. This choice is outside the scope of this
specification.
Internet Engineering Task Force D. Katz
Internet-Draft Juniper Networks
Updates: 5880 (if approved) D. Ward
Intended status: Standards Track Cisco Systems
Expires: November 27, 2018 S. Pallagatti, Ed.
Individual contributor
G. Mirsky, Ed.
ZTE Corp.
May 26, 2018
BFD for Multipoint Networks
draft-ietf-bfd-multipoint-17
Abstract
This document describes extensions to the Bidirectional Forwarding
Detection (BFD) protocol for its use in multipoint and multicast
networks.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on November 27, 2018.
Copyright Notice
Copyright (c) 2018 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
Katz, et al. Expires November 27, 2018 [Page 1]
Internet-Draft BFD for Multipoint Networks May 2018
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Keywords . . . . . . . . . . . . . . . . . . . . . . . . . . 3
3. Goals . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
4. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . 4
5. Protocol Details . . . . . . . . . . . . . . . . . . . . . . 4
5.1. Multipoint BFD Control Packets . . . . . . . . . . . . . 4
5.2. Session Model . . . . . . . . . . . . . . . . . . . . . . 5
5.3. Session Failure Semantics . . . . . . . . . . . . . . . . 5
5.4. State Variables . . . . . . . . . . . . . . . . . . . . . 5
5.4.1. New State Variable Values . . . . . . . . . . . . . . 5
5.4.2. State Variable Initialization and Maintenance . . . . 6
5.5. State Machine . . . . . . . . . . . . . . . . . . . . . . 6
5.6. Session Establishment . . . . . . . . . . . . . . . . . . 7
5.7. Discriminators and Packet Demultiplexing . . . . . . . . 7
5.8. Packet consumption on tails . . . . . . . . . . . . . . . 8
5.9. Bringing Up and Shutting Down Multipoint BFD Service . . 8
5.10. Timer Manipulation . . . . . . . . . . . . . . . . . . . 9
5.11. Detection Times . . . . . . . . . . . . . . . . . . . . . 9
5.12. State Maintenance for Down/AdminDown Sessions . . . . . . 9
5.12.1. MultipointHead Sessions . . . . . . . . . . . . . . 10
5.12.2. MultipointTail Sessions . . . . . . . . . . . . . . 10
5.13. Base Specification Text Replacement . . . . . . . . . . . 10
5.13.1. Reception of BFD Control Packets . . . . . . . . . . 10
5.13.2. Demultiplexing BFD Control Packets . . . . . . . . . 13
5.13.3. Transmitting BFD Control Packets . . . . . . . . . . 14
6. Assumptions . . . . . . . . . . . . . . . . . . . . . . . . . 17
7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 17
8. Security Considerations . . . . . . . . . . . . . . . . . . . 17
9. Contributors . . . . . . . . . . . . . . . . . . . . . . . . 17
10. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 18
11. References . . . . . . . . . . . . . . . . . . . . . . . . . 18
11.1. Normative References . . . . . . . . . . . . . . . . . . 18
11.2. Informational References . . . . . . . . . . . . . . . . 18
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 19
1. Introduction
The Bidirectional Forwarding Detection protocol [RFC5880] specifies a
method for verifying unicast connectivity between a pair of systems.
This document defines a method for using BFD to provide verification
of multipoint or multicast connectivity between a multipoint sender
Katz, et al. Expires November 27, 2018 [Page 2]
Internet-Draft BFD for Multipoint Networks May 2018
(the "head") and a set of one or more multipoint receivers (the
"tails").
As multipoint transmissions are inherently unidirectional, this
mechanism purports only to verify this unidirectional connectivity.
Although this seems in conflict with the "Bidirectional" in BFD, the
protocol is capable of supporting this use case. Use of BFD in
Demand mode enables a tail monitor availability of a multipoint path
even without the existence of some kind of a return path to the head.
This application of BFD allows for the tails to detect a lack of
connectivity from the head. Due to unidirectional nature, virtually
all options and timing parameters are controlled by the head.
As an option, the tail may notify the head of the lack of multipoint
connectivity. Details of tail notification to the head are outside
the scope of this document and are discussed in
[I-D.ietf-bfd-multipoint-active-tail].
Throughout this document, the term "multipoint" is defined as a
mechanism by which one or more systems receive packets sent by a
single sender. This specifically includes such things as IP
multicast and point-to-multipoint MPLS.
Term "connectivity" in this document is not being used in the context
of connectivity verification in transport network but as an
alternative to "continuity", i.e., the existence of a forwarding path
between the sender and the receiver.
This document effectively updates and extends the base BFD
specification [RFC5880].
2. Keywords
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in BCP
14 [RFC2119] [RFC8174] when, and only when, they appear in all
capitals, as shown here.
3. Goals
The primary goal of this mechanism is to allow tails to rapidly
detect the fact that multipoint connectivity from the head has
failed.
Another goal is for the mechanism to work on any multicast
technology.
Katz, et al. Expires November 27, 2018 [Page 3]
Internet-Draft BFD for Multipoint Networks May 2018
A further goal is to support multiple, overlapping point-to-
multipoint paths, as well as multipoint-to-multipoint paths, and to
allow point-to-point BFD sessions to operate simultaneously among the
systems participating in Multipoint BFD.
It is not a goal for this protocol to verify point-to-point bi-
directional connectivity between the head and any tail. This can be
done independently (and with no penalty in protocol overhead) by
using point-to-point BFD.
4. Overview
The heart of this protocol is the periodic transmission of BFD
Control packets along a multipoint path, from the head to all tails
on the path. The contents of the BFD packets provide the means for
the tails to calculate the detection time for path failure. If no
BFD Control packets are received by a tail for a detection time, the
tail declares the path to have failed. For some applications this is
the only mechanism necessary; the head can remain ignorant of the
tails.
The head of a multipoint BFD session may wish to be alerted to the
tails' connectivity (or lack thereof). Details of how the head keeps
track of tails and how tails alert their connectivity to the head are
outside scope of this document and are discussed in
[I-D.ietf-bfd-multipoint-active-tail].
Although this document describes a single head and a set of tails
spanned by a single multipoint path, the protocol is capable of
supporting (and discriminating between) more than one multipoint path
at both heads and tails, as described in Section 5.7 and
Section 5.13.2. Furthermore, the same head and tail may share
multiple multipoint paths, and a multipoint path may have multiple
heads.
5. Protocol Details
This section describes the operation of Multipoint BFD in detail.
5.1. Multipoint BFD Control Packets
Multipoint BFD Control packets (packets sent by the head over a
multipoint path) are explicitly marked as such, via the setting of
the M bit [RFC5880]. This means that Multipoint BFD does not depend
on the recipient of a packet to know whether the packet was received
over a multipoint path. This can be useful in scenarios where this
information may not be available to the recipient.
Katz, et al. Expires November 27, 2018 [Page 4]
Internet-Draft BFD for Multipoint Networks May 2018
5.2. Session Model
Multipoint BFD is modeled as a set of sessions of different types.
The elements of procedure differ slightly for each type.
The head has a session of type MultipointHead, as defined in
Section 5.4.1, that is bound to a multipoint path. Multipoint BFD
Control packets are sent by this session over the multipoint path,
and no BFD Control packets are received by it.
Each tail has a session of type MultipointTail, as defined in
Section 5.4.1, associated with a multipoint path. These sessions
receive BFD Control packets from the head over the multipoint path.
5.3. Session Failure Semantics
The semantics of session failure is subtle enough to warrant further
explanation.
MultipointHead sessions cannot fail (since they are controlled
administratively).
If a MultipointTail session fails, it means that the tail definitely
has lost contact with the head (or the head has been administratively
disabled) and the tail should take appropriate action.
5.4. State Variables
Multipoint BFD introduces some new state variables and modifies the
usage of a few existing ones.
5.4.1. New State Variable Values
A number of new values of the state variable bfd.SessionType are
added to the base BFD [RFC5880] and base S-BFD [RFC7880]
specifications in support of Multipoint BFD.
bfd.SessionType
The type of this session as defined in [RFC7880]. Newly added
values are:
PointToPoint: Classic point-to-point BFD, as described in
[RFC5880].
MultipointHead: A session on the head responsible for the
periodic transmission of multipoint BFD Control packets
along the multipoint path.
Katz, et al. Expires November 27, 2018 [Page 5]
Internet-Draft BFD for Multipoint Networks May 2018
MultipointTail: A multipoint session on a tail.
This variable MUST be initialized to the appropriate type when
the session is created.
5.4.2. State Variable Initialization and Maintenance
Some state variables defined in section 6.8.1 of [RFC5880] need to be
initialized or manipulated differently depending on the session type.
bfd.RequiredMinRxInterval
This variable MUST be initialized to 0 for session type
MultipointHead.
bfd.DemandMode
This variable MUST be initialized to 1 for session type
MultipointHead and MUST be initialized to 0 for session type
MultipointTail.
5.5. State Machine
The BFD state machine works slightly differently in the multipoint
application. In particular, since there is a many-to-one mapping,
three-way handshakes for session establishment and teardown are
neither possible nor appropriate. As such, there is no Init state.
Sessions of type MultipointHead MUST NOT send BFD control packets
with the State field being set to INIT, and those packets MUST be
ignored on receipt.
The following diagram provides an overview of the state machine for
session type MultipointTail. The notation on each arc represents the
state of the remote system (as received in the State field in the BFD
Control packet) or indicates the expiration of the Detection Timer.
DOWN, ADMIN DOWN,
+------+ TIMER +------+
+----| |<---------------------| |----+
DOWN,| | DOWN | | UP | |UP
ADMIN DOWN,+--->| |--------------------->| |<---+
TIMER +------+ UP +------+
Sessions of type MultipointHead never receive packets and have no
Detection Timer, and as such all state transitions are
administratively driven.
Katz, et al. Expires November 27, 2018 [Page 6]
Internet-Draft BFD for Multipoint Networks May 2018
5.6. Session Establishment
Unlike point-to-point BFD, Multipoint BFD provides a form of the
discovery mechanism for tails to discover the head. The minimum
amount of a priori information required both on the head and tails is
the binding to the multipoint path over which BFD is running. The
head transmits Multipoint BFD packets on that path, and the tails
listen for BFD packets on that path. All other information MAY be
determined dynamically.
A session of type MultipointHead is created for each multipoint path
over which the head wishes to run BFD. This session runs in the
Active role , per section 6.1 [RFC5880]. Except when
administratively terminating BFD service, this session is always in
state Up and always operates in Demand mode. No received packets are
ever demultiplexed to the MultipointHead session. In this sense, it
is a degenerate form of a session.
Sessions on the tail MAY be established dynamically, based on the
receipt of a Multipoint BFD Control packet from the head, and are of
type MultipointTail. Tail sessions always take the Passive role, per
section 6.1 [RFC5880].
5.7. Discriminators and Packet Demultiplexing
The use of Discriminators is somewhat different in Multipoint BFD
than in Point-to-point BFD.
The head sends Multipoint BFD Control packets over the multipoint
path via the MultipointHead session with My Discr set to a value
bound to the multipoint path, and with Your Discr set to zero.
IP and MPLS multipoint tails MUST demultiplex BFD packets based on a
combination of the source address, My Discriminator and the identity
of the multipoint path which the Multipoint BFD Control packet was
received from. Together they uniquely identify the head of the
multipoint path. Bootstrapping BFD session to multipoint MPLS LSP in
case of penultimate hop popping may use control plane, e.g., as
described in [I-D.ietf-bess-mvpn-fast-failover], and is outside the
scope of this document.
Note that, unlike point-to-point sessions, the My Discriminator value
on MultipointHead session MUST NOT be changed during the life of a
session. This is a side effect of the more complex demultiplexing
scheme.
Katz, et al. Expires November 27, 2018 [Page 7]
Internet-Draft BFD for Multipoint Networks May 2018
5.8. Packet consumption on tails
BFD packets received on tails for an IP multicast group MUST be
consumed by tails and MUST NOT be forwarded to receivers. Nodes with
the BFD session of type MultipointTail MUST identify packets received
on an IP multipoint path as BFD control packet if the destination UDP
port value equals 3784.
For multipoint LSPs, when IP/UDP encapsulation of BFD control packets
is used, MultipointTail MUST expect destination UDP port 3784.
Destination IP address of BFD control packet MUST be in 127.0.0.0/8
range for IPv4 or in 0:0:0:0:0:FFFF:7F00:0/104 range for IPv6. The
use of these destination addresses is consistent with the
explanations and usage in [RFC8029]. Packets identified as BFD
packets MUST be consumed by MultipointTail and demultiplexed as
described in Section 5.13.2. Use of other types of encapsulation of
the BFD control message over multipoint LSP is outside the scope of
this document.
5.9. Bringing Up and Shutting Down Multipoint BFD Service
Because there is no three-way handshake in Multipoint BFD, a newly
started head (that does not have any previous state information
available) SHOULD start with bfd.SessionState set to Down and
bfd.RequiredMinRxInterval MUST be set to zero in the MultipointHead
session. The session SHOULD remain in this state for a time equal to
(bfd.DesiredMinTxInterval * bfd.DetectMult). This will ensure that
all MultipointTail sessions are reset (so long as the restarted head
is using the same or a larger value of bfd.DesiredMinTxInterval than
it did previously).
Multipoint BFD service is brought up by administratively setting
bfd.SessionState to Up in the MultipointHead session.
The head of a multipoint BFD session may wish to shut down its BFD
service in a controlled fashion. This is desirable because the tails
need not wait a detection time prior to declaring the multipoint
session to be down (and taking whatever action is necessary in that
case).
To shut down a multipoint session the head MUST administratively set
bfd.SessionState in the MultipointHead session to either Down or
AdminDown and SHOULD set bfd.RequiredMinRxInterval to zero. The
session SHOULD send BFD Control packets in this state for a period
equal to (bfd.DesiredMinTxInterval * bfd.DetectMult).
Katz, et al. Expires November 27, 2018 [Page 8]
Internet-Draft BFD for Multipoint Networks May 2018
5.10. Timer Manipulation
Because of the one-to-many mapping, a session of type MultipointHead
SHOULD NOT initiate a Poll Sequence in conjunction with timer value
changes. However, to indicate a change in the packets,
MultipointHead session MUST send packets with the P bit set.
MultipointTail session MUST NOT reply if the packet has M and P bits
set and bfd.RequiredMinRxInterval set to 0.
The MultipointHead, when changing the transmit interval to a higher
value, MUST send BFD control packets with P bit set at the old
transmit interval before using the higher value in order to avoid
false detection timeouts at the tails. MultipointHead session MAY
also wait some amount of time before making the changes to the
transmit interval (through configuration).
Change in the value of bfd.RequiredMinRxInterval is outside the scope
of this document and is discussed in
[I-D.ietf-bfd-multipoint-active-tail]".
5.11. Detection Times
Multipoint BFD is inherently asymmetric. As such, each session type
has a different approach to detection times.
Since MultipointHead sessions never receive packets, they do not
calculate a detection time.
MultipointTail sessions cannot influence the transmission rate of the
MultipointHead session using the Required Min Rx Interval field
because of its one-to-many nature. As such, the detection time
calculation for a MultipointTail session does not use
bfd.RequiredMinRxInterval. The detection time is calculated as the
product of the last received values of Desired Min TX Interval and
Detect Mult.
The value of bfd.DetectMult may be changed at any time on any session
type.
5.12. State Maintenance for Down/AdminDown Sessions
The length of time session state is kept after the session goes down
determines how long the session will continue to send BFD Control
packets (since no packets can be sent after the session is
destroyed).
Katz, et al. Expires November 27, 2018 [Page 9]
Internet-Draft BFD for Multipoint Networks May 2018
5.12.1. MultipointHead Sessions
When a MultipointHead session transitions to states Down or
AdminDown, the state SHOULD be maintained for a period equal to
(bfd.DesiredMinTxInterval * bfd.DetectMult) to ensure that the tails
more quickly detect the session going down (by continuing to transmit
BFD Control packets with the new state).
5.12.2. MultipointTail Sessions
MultipointTail sessions MAY be destroyed immediately upon leaving Up
state, since tail will transmit no packets.
Otherwise, MultipointTail sessions SHOULD be maintained as long as
BFD Control packets are being received by it (which by definition
will indicate that the head is not Up).
5.13. Base Specification Text Replacement
The following sections are meant to replace the corresponding
sections in the base specification [RFC5880] in support of BFD for
multipoint networks while not changing processing for point-to-point
BFD.
5.13.1. Reception of BFD Control Packets
The following procedure replaces entire section 6.8.6 of [RFC5880].
When a BFD Control packet is received, the following procedure MUST
be followed, in the order specified. If the packet is discarded
according to these rules, processing of the packet MUST cease at that
point.
If the version number is not correct (1), the packet MUST be
discarded.
If the Length field is less than the minimum correct value (24 if
the A bit is clear, or 26 if the A bit is set), the packet MUST be
discarded.
If the Length field is greater than the payload of the
encapsulating protocol, the packet MUST be discarded.
If the Detect Mult field is zero, the packet MUST be discarded.
If the My Discriminator field is zero, the packet MUST be
discarded.
Katz, et al. Expires November 27, 2018 [Page 10]
Internet-Draft BFD for Multipoint Networks May 2018
Demultiplex the packet to a session according to Section 5.13.2
below. The result is either a session of the proper type, or the
packet is discarded (and packet processing MUST cease).
If the A bit is set and no authentication is in use (bfd.AuthType
is zero), the packet MUST be discarded.
If the A bit is clear and authentication is in use (bfd.AuthType
is nonzero), the packet MUST be discarded.
If the A bit is set, the packet MUST be authenticated under the
rules of [RFC5880] section 6.7, based on the authentication type
in use (bfd.AuthType). This may cause the packet to be discarded.
Set bfd.RemoteDiscr to the value of My Discriminator.
Set bfd.RemoteState to the value of the State (Sta) field.
Set bfd.RemoteDemandMode to the value of the Demand (D) bit.
Set bfd.RemoteMinRxInterval to the value of Required Min RX
Interval.
If the Required Min Echo RX Interval field is zero, the
transmission of Echo packets, if any, MUST cease.
If a Poll Sequence is being transmitted by the local system and
the Final (F) bit in the received packet is set, the Poll Sequence
MUST be terminated.
If bfd.SessionType is PointToPoint, update the transmit interval
as described in [RFC5880] section 6.8.2.
If bfd.SessionType is PointToPoint, update the Detection Time as
described in section 6.8.4 of [RFC5880].
Else
If bfd.SessionType is MultipointTail, then update the Detection
Time as the product of the last received values of Desired Min
TX Interval and Detect Mult, as described in Section 5.11 of
this specification.
If bfd.SessionState is AdminDown
Discard the packet
If the received state is AdminDown
Katz, et al. Expires November 27, 2018 [Page 11]
Internet-Draft BFD for Multipoint Networks May 2018
If bfd.SessionState is not Down
Set bfd.LocalDiag to 3 (Neighbor signaled session down)
Set bfd.SessionState to Down
Else
If bfd.SessionState is Down
If bfd.SessionType is PointToPoint
If received State is Down
Set bfd.SessionState to Init
Else if received State is Init
Set bfd.SessionState to Up
Else (bfd.SessionType is not PointToPoint)
If received State is Up
Set bfd.SessionState to Up
Else if bfd.SessionState is Init
If received State is Init or Up
Set bfd.SessionState to Up
Else (bfd.SessionState is Up)
If received State is Down
Set bfd.LocalDiag to 3 (Neighbor signaled session down)
Set bfd.SessionState to Down
Check to see if Demand mode should become active or not (see
[RFC5880] section 6.6).
If bfd.RemoteDemandMode is 1, bfd.SessionState is Up and
bfd.RemoteSessionState is Up, Demand mode is active on the remote
system and the local system MUST cease the periodic transmission
of BFD Control packets (see Section 5.13.3).
Katz, et al. Expires November 27, 2018 [Page 12]
Internet-Draft BFD for Multipoint Networks May 2018
If bfd.RemoteDemandMode is 0, or bfd.SessionState is not Up, or
bfd.RemoteSessionState is not Up, Demand mode is not active on the
remote system and the local system MUST send periodic BFD Control
packets (see Section 5.13.3).
If the packet was not discarded, it has been received for purposes
of the Detection Time expiration rules in [RFC5880] section 6.8.4.
5.13.2. Demultiplexing BFD Control Packets
This section is part of the replacement for [RFC5880] section 6.8.6,
separated for clarity.
If the Multipoint (M) bit is set
If the Your Discriminator field is nonzero, the packet MUST be
discarded.
Select a session as based on source address, My Discriminator
and the identity of the multipoint path which the Multipoint
BFD Control packet was received.
If a session is found, and bfd.SessionType is not
MultipointTail, the packet MUST be discarded.
Else
If a session is not found, a new session of type
MultipointTail MAY be created, or the packet MAY be
discarded. This choice MAY be controlled by the local
policy and is outside the scope of this specification.
Else (Multipoint bit is clear)
If the Your Discriminator field is nonzero
Select a session based on the value of Your Discriminator.
If no session is found, the packet MUST be discarded.
Else (Your Discriminator is zero)
If the State field is not Down or AdminDown, the packet MUST
be discarded.
Otherwise, the session MUST be selected based on some
combination of other fields, possibly including source
addressing information, the My Discriminator field, and the
interface over which the packet was received. The exact
Katz, et al. Expires November 27, 2018 [Page 13]
Internet-Draft BFD for Multipoint Networks May 2018
method of selection is application-specific and is thus
outside the scope of this specification.
If a matching session is found, and bfd.SessionType is not
PointToPoint, the packet MUST be discarded.
If a matching session is not found, a new session of type
PointToPoint MAY be created, or the packet MAY be discarded.
This choice MAY be controlled by a local policy and is
outside the scope of this specification.
If the State field is Init and bfd.SessionType is not
PointToPoint, the packet MUST be discarded.
5.13.3. Transmitting BFD Control Packets
The following procedure replaces entire section 6.8.7 of [RFC5880].
BFD Control packets MUST be transmitted periodically at the rate
determined according to [RFC5880] section 6.8.2, except as specified
in this section.
A system MUST NOT transmit any BFD Control packets if bfd.RemoteDiscr
is zero and the system is taking the Passive role.
A system MUST NOT transmit any BFD Control packets if bfd.SessionType
is MultipointTail.
A system MUST NOT periodically transmit BFD Control packets if Demand
mode is active on the remote system (bfd.RemoteDemandMode is 1,
bfd.SessionState is Up, and bfd.RemoteSessionState is Up) and a Poll
Sequence is not being transmitted.
A system MUST NOT periodically transmit BFD Control packets if
bfd.RemoteMinRxInterval is zero.
If bfd.SessionType is MultipointHead, the transmit interval MUST be
set to bfd.DesiredMinTxInterval (this should happen automatically, as
bfd.RemoteMinRxInterval will be zero).
If bfd.SessionType is not MultipointHead, the transmit interval MUST
be recalculated whenever bfd.DesiredMinTxInterval changes, or
whenever bfd.RemoteMinRxInterval changes, and is equal to the greater
of those two values. See [RFC5880] sections 6.8.2 and 6.8.3 for
details on transmit timers.
A system MUST NOT set the Demand (D) bit if bfd.SessionType is
MultipointTail.
Katz, et al. Expires November 27, 2018 [Page 14]
Internet-Draft BFD for Multipoint Networks May 2018
A system MUST NOT set the Demand (D) bit if bfd.SessionType
PointToPoint unless bfd.DemandMode is 1, bfd.SessionState is Up, and
bfd.RemoteSessionState is Up.
If bfd.SessionType is PointToPoint or MultipointHead, a BFD Control
packet SHOULD be transmitted during the interval between periodic
Control packet transmissions when the contents of that packet would
differ from that in the previously transmitted packet (other than the
Poll and Final bits) in order to more rapidly communicate a change in
state.
The contents of transmitted BFD Control packets MUST be set as
follows:
Version
Set to the current version number (1).
Diagnostic (Diag)
Set to bfd.LocalDiag.
State (Sta)
Set to the value indicated by bfd.SessionState.
Poll (P)
Set to 1 if the local system is sending a Poll Sequence or is a
session of type MultipointHead soliciting the identities of the
tails, or 0 if not.
Final (F)
Set to 1 if the local system is responding to a Control packet
received with the Poll (P) bit set, or 0 if not.
Control Plane Independent (C)
Set to 1 if the local system's BFD implementation is
independent of the control plane (it can continue to function
through a disruption of the control plane).
Authentication Present (A)
Set to 1 if authentication is in use in this session
(bfd.AuthType is nonzero), or 0 if not.
Katz, et al. Expires November 27, 2018 [Page 15]
Internet-Draft BFD for Multipoint Networks May 2018
Demand (D)
Set to bfd.DemandMode if bfd.SessionState is Up and
bfd.RemoteSessionState is Up. Set to 1 if bfd.SessionType is
MultipointHead. Otherwise it is set to 0.
Multipoint (M)
Set to 1 if bfd.SessionType is MultipointHead. Otherwise, it
is set to 0.
Detect Mult
Set to bfd.DetectMult.
Length
Set to the appropriate length, based on the fixed header length
(24) plus any Authentication Section.
My Discriminator
Set to bfd.LocalDiscr.
Your Discriminator
Set to bfd.RemoteDiscr.
Desired Min TX Interval
Set to bfd.DesiredMinTxInterval.
Required Min RX Interval
Set to bfd.RequiredMinRxInterval.
Required Min Echo RX Interval
Set to 0 if bfd.SessionType is MultipointHead or
MultipointTail.
Authentication Section
Included and set according to the rules in [RFC5880] section
6.7 if authentication is in use (bfd.AuthType is nonzero).
Otherwise, this section is not present.
Katz, et al. Expires November 27, 2018 [Page 16]
Internet-Draft BFD for Multipoint Networks May 2018
6. Assumptions
If authentication is in use, the head and all tails must be
configured to have a common authentication key in order for the tails
to validate received the multipoint BFD Control packets.
7. IANA Considerations
This document has no actions for IANA.
8. Security Considerations
The same security considerations as those described in [RFC5880]
apply to this document. Additionally, implementations that create
MultpointTail sessions dynamically upon receipt of Multipoint BFD
Control packets MUST implement protective measures to prevent an
infinite number of MultipointTail sessions being created. Below are
listed some points to be considered in such implementations.
If a Multipoint BFD Control packet did not arrive on a multicast
path (e.g., on the expected interface, with expected MPLS label,
etc), then a MultipointTail session should not be created.
If redundant streams are expected for a given multicast stream,
then the implementations should not create more MultipointTail
sessions than the number of streams. Additionally, when the
number of MultipointTail sessions exceeds the number of expected
streams, then the implementation should generate an alarm to users
to indicate the anomaly.
The implementation should have a reasonable upper bound on the
number of MultipointTail sessions that can be created, with the
upper bound potentially being computed based on the number of
multicast streams that the system is expecting.
Use of shared keys to authenticate BFD Control packet in multipoint
scenarios is limited because tail can spoof the head from the
viewpoint of the other tails. Thus, if shared keys are used, all
tails MUST be trusted not to spoof the head. Otherwise, asymmetric
message authentication would be needed, e.g., Timed Efficient Stream
Loss-Tolerant Authentication (TESLA) as described in [RFC4082].
9. Contributors
Rahul Aggarwal of Juniper Networks and George Swallow of Cisco
Systems provided the initial idea for this specification and
contributed to its development.
Katz, et al. Expires November 27, 2018 [Page 17]
Internet-Draft BFD for Multipoint Networks May 2018
10. Acknowledgments
Authors would also like to thank Nobo Akiya, Vengada Prasad Govindan,
Jeff Haas, Wim Henderickx, Gregory Mirsky and Mingui Zhang who have
greatly contributed to this document.
11. References
11.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<https://www.rfc-editor.org/info/rfc2119>.
[RFC5880] Katz, D. and D. Ward, "Bidirectional Forwarding Detection
(BFD)", RFC 5880, DOI 10.17487/RFC5880, June 2010,
<https://www.rfc-editor.org/info/rfc5880>.
[RFC7880] Pignataro, C., Ward, D., Akiya, N., Bhatia, M., and S.
Pallagatti, "Seamless Bidirectional Forwarding Detection
(S-BFD)", RFC 7880, DOI 10.17487/RFC7880, July 2016,
<https://www.rfc-editor.org/info/rfc7880>.
[RFC8029] Kompella, K., Swallow, G., Pignataro, C., Ed., Kumar, N.,
Aldrin, S., and M. Chen, "Detecting Multiprotocol Label
Switched (MPLS) Data-Plane Failures", RFC 8029,
DOI 10.17487/RFC8029, March 2017,
<https://www.rfc-editor.org/info/rfc8029>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <https://www.rfc-editor.org/info/rfc8174>.
11.2. Informational References
[I-D.ietf-bess-mvpn-fast-failover]
Morin, T., Kebler, R., and G. Mirsky, "Multicast VPN fast
upstream failover", draft-ietf-bess-mvpn-fast-failover-03
(work in progress), May 2018.
[I-D.ietf-bfd-multipoint-active-tail]
Katz, D., Ward, D., Networks, J., and G. Mirsky, "BFD
Multipoint Active Tails.", draft-ietf-bfd-multipoint-
active-tail-07 (work in progress), February 2018.
Katz, et al. Expires November 27, 2018 [Page 18]
Internet-Draft BFD for Multipoint Networks May 2018
[RFC4082] Perrig, A., Song, D., Canetti, R., Tygar, J., and B.
Briscoe, "Timed Efficient Stream Loss-Tolerant
Authentication (TESLA): Multicast Source Authentication
Transform Introduction", RFC 4082, DOI 10.17487/RFC4082,
June 2005, <https://www.rfc-editor.org/info/rfc4082>.
Authors' Addresses
Dave Katz
Juniper Networks
1194 N. Mathilda Ave.
Sunnyvale, California 94089-1206
USA
Email: dkatz@xxxxxxxxxxx
Dave Ward
Cisco Systems
170 West Tasman Dr.
San Jose, California 95134
USA
Email: wardd@xxxxxxxxx
Santosh Pallagatti (editor)
Individual contributor
Email: santosh.pallagatti@xxxxxxxxx
Greg Mirsky (editor)
ZTE Corp.
Email: gregimirsky@xxxxxxxxx
Katz, et al. Expires November 27, 2018 [Page 19]
<<< text/html; charset="UTF-8"; name="Diff_ draft-ietf-bfd-multipoint-16.txt - draft-ietf-bfd-multipoint-17.txt.html": Unrecognized >>>
